<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements.  See the NOTICE file
distributed with this work for additional information
regarding copyright ownership.  The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License.  You may obtain a copy of the License at

  http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied.  See the License for the
specific language governing permissions and limitations
under the License.
-->

<html>
  <head>
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>October 2013 ngx_pagespeed Security Update.</title>
    <link rel="stylesheet" href="doc.css">
  </head>
  <body>
<!--#include virtual="_header.html" -->


  <div id=content>
<h1>October 2013 ngx_pagespeed Security Update.</h1>
<h2 id="overview">Overview</h2>

<p>
All versions of ngx_pagespeed prior to 1.6.29.7 are subject to critical
cross-site scripting (XSS) vulnerability CVE-2013-6111.  Depending on
configuration this may permit a hostile third party to execute JavaScript in
users' browsers in the context of the domain running ngx_pagespeed, which could
permit theft of users' cookies or data on the site.
</p>

<p>
Because of the severity of the problem, users of affected versions are
<strong>strongly</strong> encouraged to <strong>immediately</strong> update
ngx_pagespeed or apply the workaround below.
</p>

<p>
To be notified of further security updates subscribe to the
<a href="mailing-lists#announcements">announcements mailing list</a>.
</p>

<h2 id="solutions">Solutions</h2>

<p>
Users of affected versions should either apply the workaround or update to
version 1.6.29.7 or later.
</p>

<h3 id="workaround">Workaround</h3>

<p>
The vulnerability requires access to <code>/ngx_pagespeed_statistics</code>,
<code>/ngx_pagespeed_global_statistics</code>, or
<code>/ngx_pagespeed_message</code>. Prohibiting access to these in
your <code>nginx.conf</code> is sufficient to keep it from being exploited.
Note that it is not enough to restrict these pages to trusted users; they must
not be accessible to anyone.  Example workaround configuration:
<pre>
location /ngx_pagespeed_statistics { deny all; }
location /ngx_pagespeed_global_statistics { deny all; }
location /ngx_pagespeed_message { deny all; }
</pre>
</p>

<p>
While ngx_pagespeed and mod_pagespeed are very similar, this workaround is not
sufficient for mod_pagespeed.  If you also run PageSpeed in Apache please follow
the recommendations in the <a href="announce-sec-update-201310">October 2013
mod_pagespeed Security Update</a>.
</p>

<h3 id="update">Update</h3>

<p>
Users unable to apply the workaround, or who want continued access to the
informational data provided by <code>/ngx_pagespeed_statistics</code>
or <code>/ngx_pagespeed_message</code> should update to an unaffected version.
This requires building nginx with the updated ngx_pagespeed module and
installing it in place of the current version.  See
the <a href="https://github.com/apache/incubator-pagespeed-ngx#how-to-build">build
instructions</a>.
</p>

<p>
Users having difficulty applying these updates or with other questions should
write to the <a href="mailing-lists#discussion">discussion group</a>.

  </div>
  <!--#include virtual="_footer.html" -->
  </body>
</html>
